DPO
UK GDPR in Schools – Data Protection Officer Services for Education
Service
As an education provider, you have a responsibility to protect your students, staff and school. This responsibility isn’t just about protecting the physical form – it is also the protection of information or data you hold about individuals and how that is managed and controlled.
Many of our specialists are former senior leaders and teachers, alongside experienced data protection professionals, so our dedicated support as your Data Protection Officer is not only compliant, but also practical, relevant and suited to the realities of trusts, schools and wider education settings. We offer this through unlimited phone and email support and our dedicated Compliance Portal, designed for education settings – allowing you to access valuable resources and report, record and track data compliance tasks.
We also provide full-organisation data compliance audits – helping you understand your current position and identify areas for improvements, and an add-on SAR redaction package – helping you manage the process of removing sensitive information from SAR-response documents efficiently and securely.
Solution
Through our unlimited phone and email support, DPO site visits and online compliance portal and training dashboard; we:
- Provide advice and guidance on all data compliance queries
- Provide free training for employees
- Conduct internal audits of your data processes up to twice a year
- Support the management of Subject Access Requests and those under the Freedom of Information Act 2000
- Support the management, including investigation, reporting and review, of data breach incidents
- Act as the first point of contact with authorities
- Provide policy and document templates (including DPIA and DPAs)
- Support you to draft data policies and procedures
- Provide downloadable compliance log and audit reports for review at governor or trustee level
- Support and monitor the maintenance of data records
The compliance portal is split into eight distinct sections:
- Audits – audit your school against the ICO’s accountability framework. Create a RAG-rated development plan with actions for Amber and Red expectations in order to create the plan to fully meet all expectations over time.
- Breaches – log and report on any data breaches that may occur in your schools.
- Subject Access Requests – log and report on any subject access requests that may occur in your schools.
- Data Decisions – log and report on any data decisions made where data is processed in such a way that could create risks to the rights and freedoms of individuals, or it involves special categories of data. It can also be used to log incidences of one-off data sharing.
- Data Map – identify what categories of data are processed, the purpose for which are they are processed, the legal basis for processing, where they are held, how they are obtained and who they are shared with.
- Data Processors – identify which data processors your school shares data with, which data categories are shared, whether the processors are compliant with the UK GDPR, and what security and retention periods are in place with them.
- Global Documents – access and download all of our supporting material for data protection including policy templates, training resources, privacy notices, retention schedules and data protection impact assessments.
- School Documents – access and download any school-specific documents once completed such as audit reports and your data maps.
Training
Our online training platform allows you to purchase courses for individual members of staff in our shop or use the link below to purchase group licences for your whole school. As we are experienced school leaders, we do understand the need for all roles in school, so our advice and guidance is education- and role-specific. Access to our online training platform is FREE for organisations that are signed up to our Data Protection Officer service. Order training packages for your staff, by clicking the button below.
Our training platform includes:
- Cyber Security for Schools (NCCS compliant)
- Data Protection for Education Staff
- Data Protection for Child Protection Leads
- Data Protection for Governors/Trustees (maintained schools and standalone academies)
- Data Protection for MAT Governors/Trustees
- Data Protection for Lunchtime, Cleaning and Site Staff
- Data Protection for School Administrators
We also offer in-person CPD sessions, delivered directly to staff, so they can fully engage and ask questions that are directly relevant to school staff and their specific role. Whole staff sessions run for about an hour, other bespoke sessions can vary in length depending on need.
DPO Service Packages
Our DPO service is cost-neutral compared to other, alternative solutions. For a school to appoint their own DPO, they will need to fund training for that individual and give them time to complete the role effectively. They will possibly also need to provide a financial incentive (such as a TLR) to them. Our experience and knowledge base (as well as economies of scale due to working with hundreds of schools) allow us to dramatically cut down these costs.
For example, a school senior leader earning £50k p.a. who is given an hour a week across the year to complete their DPO work is costing a school at least £2k which is more than our highest rate.
Frequently Asked Questions
How often will SchoolPro DPOs do onsite visits?
Depending on the level of service you choose, you can opt to see your DPO annually for audits and/or training – you can choose to see them on site or via a Teams meeting. They will also be available whenever needed in the event of a data protection incident.
Will I get remote support from SchoolPro?
Yes, your DPO will be available via phone and email when not visiting your site. You will also have access to our online portal for reporting breaches and subject access requests, logging data decisions and downloading document templates.
What about school holidays?
Our DPOs will be available to provide support both during term-time and during the school holidays.
Outside of term time, education providers still have a responsibility to report data breaches and take reasonable steps to respond to SARs, FOI requests.
Do I legally need an external DPO (Data Protection Officer) for my school or educational trust?
All schools, education providers and trusts must legally appoint a Data Protection Officer. Your DPO cannot be anyone with any strategic or operational decision-making role, with regards to data and data systems in your school.
A DPO doesn’t have to be a member of your own staff, and many of your own staff will have a conflict of interest in their existing job role. Examples of roles that are likely to not be able to be your DPO include: Headteacher, School Business Manager, Data Manager, IT Manager and most other senior leadership roles.
What are the advantages of outsourcing the DPO role for my school?
Access to high-levels of expertise and banks of resources. It also gives you an impartial view of your systems, processes and practice. In the event of a data protection incident, impact on the day-to-day running of the school will be minimal as school staff can continue to carry out their roles. It is likely that this will also be a more cost effective approach than using an existing member of staff when compared to additional non-contact time, training and, possibly, a TLR. The support is also available outside normal school working hours and during the school holidays.
What does our DPO service typically include?
- Providing advice and guidance when required
- Supporting and monitoring the maintenance of data records
- Drafting data policies and procedures
- Providing training for employees
- Acting as the first point of contact with authorities
- Supporting the management of Subject Access Requests and those under the Freedom of Information Act 2000
- Supporting the management, including investigation, reporting and review, of data breach incidents
- Conducting an internal audit of your data processes up to twice a year
- Providing you with access to our specifically designed Data Protection Portal